CVE-2026-26365
Received Received - Intake
HTTP Request Smuggling in Akamai CDN Edge Servers via Header Mishandling

Publication date: 2026-02-23

Last updated on: 2026-02-23

Assigner: MITRE

Description
Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header "Connection: Transfer-Encoding" could result in a forward request with invalid message framing, depending on the Akamai processing path. This could result in the origin server parsing the request body incorrectly, leading to HTTP request smuggling.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-23
Last Modified
2026-02-23
Generated
2026-06-16
AI Q&A
2026-02-23
EPSS Evaluated
2026-06-14
NVD
CVE-2026-26365
EUVD
EUVD-2026-7487
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
akamai ghost to 2026-02-06 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Detection Guidance

I don't know

Mitigation Strategies

I don't know

Executive Summary

This vulnerability, known as Akamai Ghost, affects Akamai CDN edge servers before February 6, 2026. It mishandles the processing of custom hop-by-hop HTTP headers. Specifically, when an incoming request contains the header "Connection: Transfer-Encoding", the server might forward a request with invalid message framing depending on how Akamai processes it. This improper handling can cause the origin server to parse the request body incorrectly, which leads to HTTP request smuggling.

Impact Analysis

The vulnerability can lead to HTTP request smuggling, which allows an attacker to interfere with the way a web server processes sequences of HTTP requests. This can result in security issues such as bypassing security controls, gaining unauthorized access to sensitive information, or causing the origin server to misinterpret requests. The CVSS score indicates a moderate impact with low complexity and no privileges required, but it can cause integrity issues.

Compliance Impact

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-26365. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart